* added a.n.o's patch to avoid NULL-ssl errorstrings in lprintfs

[citadel.git] / webcit / crypto.c

diff --git a/webcit/crypto.c b/webcit/crypto.c
index 022b64ef05c03b0cd0df1ef18f8e04d6572fc84c..1959c50484278bb2bb22bba61e5812b929af9635 100644 (file)
--- a/webcit/crypto.c
+++ b/webcit/crypto.c
@@ -7,17 +7,17 @@
  */
 
 /*@{*/
-#include "config.h"
+#include "sysdep.h"
 #ifdef HAVE_OPENSSL
 
 #include "webcit.h"
 #include "webserver.h"
 /** \todo dirify */
 /** where to find the keys */
-#define        CTDL_CRYPTO_DIR         "./keys" 
-#define CTDL_KEY_PATH          CTDL_CRYPTO_DIR "/citadel.key" /**< the key */
-#define CTDL_CSR_PATH          CTDL_CRYPTO_DIR "/citadel.csr" /**< the csr file */
-#define CTDL_CER_PATH          CTDL_CRYPTO_DIR "/citadel.cer" /**< the cer file */
+#define        CTDL_CRYPTO_DIR         ctdl_key_dir
+#define CTDL_KEY_PATH          file_crpt_file_key /**< the key */
+#define CTDL_CSR_PATH          file_crpt_file_csr /**< the csr file */
+#define CTDL_CER_PATH          file_crpt_file_cer /**< the cer file */
 #define SIGN_DAYS              365 /**< how long our certificate should live */
 
 SSL_CTX *ssl_ctx;              /**< SSL context */
@@ -148,14 +148,20 @@ void init_ssl(void)
                                }
                                fclose(fp);
                        }
+                       else {
+                               lprintf(3, "Cannot write key: %s\n", CTDL_KEY_PATH);
+                               exit(0);
+                       }
                        RSA_free(rsa);
                }
        }
 
-       /**
-        * Generate a CSR if we don't have one.
+       /*
+        * If there is no certificate file on disk, we will be generating a self-signed certificate
+        * in the next step.  Therefore, if we have neither a CSR nor a certificate, generate
+        * the CSR in this step so that the next step may commence.
         */
-       if (access(CTDL_CSR_PATH, R_OK) != 0) {
+       if ( (access(CTDL_CER_PATH, R_OK) != 0) && (access(CTDL_CSR_PATH, R_OK) != 0) ) {
                lprintf(5, "Generating a certificate signing request.\n");
 
                /**
@@ -196,14 +202,22 @@ void init_ssl(void)
                                                MBSTRING_ASC, "Mount Kisco", -1, -1, 0);
                                        */
 
-                                       X509_NAME_add_entry_by_txt(name, "O",
-                                               MBSTRING_ASC, "Organization name", -1, -1, 0);
-
-                                       X509_NAME_add_entry_by_txt(name, "OU",
-                                               MBSTRING_ASC, "Citadel server", -1, -1, 0);
-
-                                       X509_NAME_add_entry_by_txt(name, "CN",
-                                               MBSTRING_ASC, "*", -1, -1, 0);
+                                       X509_NAME_add_entry_by_txt(
+                                               name, "O",
+                                               MBSTRING_ASC, 
+                                               (unsigned char*)"Organization name",
+                                               -1, -1, 0);
+
+                                       X509_NAME_add_entry_by_txt(
+                                               name, "OU",
+                                               MBSTRING_ASC, 
+                                               (unsigned char*)"Citadel server",
+                                               -1, -1, 0);
+
+                                       X509_NAME_add_entry_by_txt(
+                                               name, "CN",
+                                               MBSTRING_ASC, 
+                                               (unsigned char*)"*", -1, -1, 0);
                                
                                        X509_REQ_set_subject_name(req, name);
 
@@ -219,6 +233,10 @@ void init_ssl(void)
                                                        PEM_write_X509_REQ(fp, req);
                                                        fclose(fp);
                                                }
+                                               else {
+                                                       lprintf(3, "Cannot write key: %s\n", CTDL_CSR_PATH);
+                                                       exit(0);
+                                               }
                                        }
 
                                        X509_REQ_free(req);
@@ -290,6 +308,10 @@ void init_ssl(void)
                                                        PEM_write_X509(fp, cer);
                                                        fclose(fp);
                                                }
+                                               else {
+                                                       lprintf(3, "Cannot write key: %s\n", CTDL_CER_PATH);
+                                                       exit(0);
+                                               }
                                        }
                                        X509_free(cer);
                                }
@@ -347,24 +369,40 @@ int starttls(int sock) {
                 * revert to unencrypted communications.
                 */
                long errval;
+               char *ssl_error_reason = NULL;
 
                errval = SSL_get_error(newssl, retval);
-               lprintf(3, "SSL_accept failed: %s\n",
-                       ERR_reason_error_string(ERR_get_error()));
+               ssl_error_reason = ERR_reason_error_string(ERR_get_error());
+               if (ssl_error_reason == NULL)
+                       lprintf(3, "SSL_accept failed: errval=%i, retval=%i\n", errval, retval);
+               else
+                       lprintf(3, "SSL_accept failed: %s\n", ssl_error_reason);
+               sleep(1);
+               retval = SSL_accept(newssl);
+       }
+       if (retval < 1) {
+               long errval;
+               char *ssl_error_reason = NULL;
+
+               errval = SSL_get_error(newssl, retval);
+               ssl_error_reason = ERR_reason_error_string(ERR_get_error());
+               if (ssl_error_reason == NULL)
+                       lprintf(3, "SSL_accept failed: errval=%i, retval=%i\n", errval, retval);
+               else
+                       lprintf(3, "SSL_accept failed: %s\n", ssl_error_reason);
                SSL_free(newssl);
                newssl = NULL;
                return(4);
-       }
+       } else lprintf(3, "SSL_accept success\n");
        BIO_set_close(newssl->rbio, BIO_NOCLOSE);
-       bits =
-           SSL_CIPHER_get_bits(SSL_get_current_cipher(newssl),
-                               &alg_bits);
+       bits = SSL_CIPHER_get_bits(SSL_get_current_cipher(newssl), &alg_bits);
        lprintf(5, "SSL/TLS using %s on %s (%d of %d bits)\n",
                SSL_CIPHER_get_name(SSL_get_current_cipher(newssl)),
                SSL_CIPHER_get_version(SSL_get_current_cipher(newssl)),
                bits, alg_bits);
 
        pthread_setspecific(ThreadSSL, newssl);
+       lprintf(3, "SSL started\n");
        return(0);
 }
 
@@ -419,7 +457,7 @@ void ssl_lock(int mode, int n, const char *file, int line)
  * \param buf chars to send to the client
  * \param nbytes how many chars
  */
-void client_write_ssl(char *buf, int nbytes)
+void client_write_ssl(const char *buf, int nbytes)
 {
        int retval;
        int nremain;
@@ -500,7 +538,7 @@ int client_read_ssl(char *buf, int bytes, int timeout)
 #endif
                if (SSL_want_read(THREADSSL)) {
                        if ((SSL_write(THREADSSL, junk, 0)) < 1) {
-                               lprintf(9, "SSL_write in client_read: %s\n", ERR_reason_error_string(ERR_get_error()));
+                               lprintf(9, "SSL_write in client_read\n");
                        }
                }
                rlen = SSL_read(THREADSSL, &buf[len], bytes - len);